10 steps to staying compliant when you're on your own

Most RIA compliance missteps are unintentional, and they happen more often than you might think.

“I'd say 95% of the people I meet are good people. They just make mistakes," says Susan Boudrot, Global Chief Compliance Officer (CCO) with TD Ameritrade Institutional. Boudrot would know: Not only has she served in compliance and as CCO for multiple custodians, but she also spent time as general counsel at a broker-dealer and as an enforcement attorney at the Securities and Exchange Commission (SEC).

How can you avoid unintentional and potentially costly compliance mistakes? A key to staying compliant is knowing a few basics and following them: Missteps can happen when you don't take the time to learn the landmines. To help you stay on the right path, consider these 10 steps:

1. Keep your Form ADV accurate and up to date. Form ADV, the standard form used to register as an investment advisor, calls for a lot of details. Fill in these details and make sure they remain an accurate and up-to-date description of what you do and for whom.

It's not uncommon for an RIA business to grow and for the firm owner to forget to update the number of clients or assets under management. If discovered by the SEC, that slip-up would likely lead to being written up (essentially a warning with no tangible consequences). However, repeated minor transgressions could land you in hot water. So could more substantial inaccuracies—especially seemingly intentional ones.

“Let's say you take on a partner who has a regulatory past and you haven't looked at that or put him on the ADV," Boudrot says. “If it looks like you were hiding him, that can be a large regulatory problem for you down the road."

2. Name a competent CCO. Hire a competent chief compliance officer and/or an outside compliance consultant. Putting someone unqualified in a token CCO position won't do much for you in the event of an on-site SEC audit. Be prepared in the event that the SEC could come calling. Just because the authorities haven't yet knocked on your door doesn't mean they won't do so next month or next year. So, be prepared.

3. Listen to your consultant. Hiring a consultant isn't good enough. That person or firm's knowledge and experience will go for naught if you don't listen to them.

Boudrot says she has seen new RIAs who don't take compliance seriously. “I have seen issues in this area often," she says. “Most people who start out on their own are salespeople. And sales and compliance are completely different disciplines."

4. Document your procedures. Keep the receipts. “If it's not documented, it didn't happen: It's that simple," says Dan Rome, RIA Compliance Consultant supporting Summit Compliance Group based in Saint Paul, MN. “Documentation really is important to demonstrate that things were actually done."

Policies, procedures, and controls should be designed to detect, prevent, or mitigate any compliance issues. Document your clients' personal information. Document your activity in their accounts. Make sure your advisory contract accurately describes your services and is signed by the client.

5. Record everything and have an organized system. A natural extension of documentation is storing those records in a safe, accessible place. Records must be current and accurate.

Advisors often forget to document things or neglect to get documentation such as an up-to-date client agreement, notes Boudrot. “Regulators rely on records. Make sure you have them and then be sure to know where they are. Keep records in a safe place and be able to turn them over promptly, when needed."

6. Understand and follow custody rules. You might not consider yourself a custodian, but you may be in for a surprise. Paying a specific monthly bill up to a certain amount for a client might be fine with the SEC. More problematic is if you have access to a client's entire bill-paying account, and you are able to write checks to anyone on behalf of the client.

7. Make sure your advertising is accurate. Quite simply, be truthful and fair. That means that you can't include testimonials—even implied testimonials like “clients love us"—because they could be misleading. Be clear when using a hypothetical example, and be careful about advertising potential results. Also, always include appropriate disclosures.

8. Put your clients' interests first and treat all clients fairly. As a fiduciary, you have an obligation to put client interests before your own. That should be clear and clearly followed. What can be trickier is ensuring you don't prioritize certain clients when conducting a large trade and allocating it across accounts. Ask yourself whether you are consistently even-handed and not favoring friends or family members.

9. Know the consequences of noncompliance. A minor, unintentional infraction might lead to a light slap on the wrist. Where things get potentially precarious is in cases of more egregious, intentional, or repeated noncompliance.

“You could have a warning the first time you violate a compliance rule, but the second time will be a problem," notes Rome. “The SEC could say, 'We didn't get your attention, so we're fining you $5,000 or $10,000. Can you hear us now?'" There's also the indirect risk to your reputation, he notes, or—even worse—the loss of one's job or certification. Risks exacerbate if a fraudulent act is deemed intentional.

10. Stay informed. Regulatory rules change. And it's your responsibility to stay up to date. One example is anti-money laundering rules, which currently don't directly affect RIAs but could soon.

You have enough to worry about as an RIA—market fluctuations, overhead, client satisfaction—without having potential compliance infractions hanging over your head. Following the simple steps above can help you stay compliant and avoid some of the common compliance mistakes.